SOLVED

Exchange 2010 - Admin audit log query

%3CLINGO-SUB%20id%3D%22lingo-sub-235680%22%20slang%3D%22en-US%22%3EExchange%202010%20-%20Admin%20audit%20log%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-235680%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWonder%20if%20someone%20could%20possibly%20assist%20me%20with%20a%20query.%20In%20Exchange%202010%20Admin%20audit%20logging%2C%20does%20it%20log%20when%20admin%20audit%20logging%20is%20turned%20off%20or%20back%20on%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EReason%20for%20my%20question%20is%20that%20an%20exchange%20admin%20could%20turn%20admin%20audit%20logging%20off%2C%20makes%20some%20changes%20and%20turn%20it%20back%20on%20again.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAppreciate%20any%20feedback%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-235680%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2010%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-236399%22%20slang%3D%22en-US%22%3ERe%3A%20Exchange%202010%20-%20Admin%20audit%20log%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-236399%22%20slang%3D%22en-US%22%3E%3CP%3EHappy%20to%20help%2C%20us%20Exchange%20guys%20have%20to%20stick%20together%20%3B)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-236157%22%20slang%3D%22en-US%22%3ERe%3A%20Exchange%202010%20-%20Admin%20audit%20log%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-236157%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F603%22%20target%3D%22_blank%22%3E%40Adam%20Ochs%3C%2FA%3E%26nbsp%3BThanks%20for%20that%20advice%20bud.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%23appreciate%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-235832%22%20slang%3D%22en-US%22%3ERe%3A%20Exchange%202010%20-%20Admin%20audit%20log%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-235832%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Navishkar%2C%3CBR%20%2F%3E%3CBR%20%2F%3EI%20do%20not%20think%20the%20exchanged%20audit%20log%20itself%20shows%20an%20enable%2Fdisable%20in%20the%20logs%2C%20but%20if%20you%20run%20Get-AdminAuditLogConfig%2C%20it%20will%20show%20you%20a%20created%20date%2C%20here%20is%20an%20example%20of%20an%20output%20from%20that%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Fsupertekboy.com%2Fwp-content%2Fuploads%2F2015%2F02%2FSet-AdminAuditLogConfig.jpg%22%20border%3D%220%22%20%2F%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20you%20can%20see%20with%20the%20when%20created%20date%2C%20I%20would%20just%20check%20your%20logs%20as%20you%20see%20fit%2C%20and%20if%20you%20think%20there%20is%20a%20discrepancy%2C%20come%20back%20and%20look%20to%20see%20the%20start%20date.%20By%20default%20the%20logs%20are%20held%20for%2090%20days.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdam%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Frequent Contributor

Hi All

 

Wonder if someone could possibly assist me with a query. In Exchange 2010 Admin audit logging, does it log when admin audit logging is turned off or back on?

 

Reason for my question is that an exchange admin could turn admin audit logging off, makes some changes and turn it back on again.

 

Appreciate any feedback

3 Replies
Highlighted
Best Response confirmed by Navishkar Sadheo (Frequent Contributor)
Solution

Hello Navishkar,

I do not think the exchanged audit log itself shows an enable/disable in the logs, but if you run Get-AdminAuditLogConfig, it will show you a created date, here is an example of an output from that:

 

 

As you can see with the when created date, I would just check your logs as you see fit, and if you think there is a discrepancy, come back and look to see the start date. By default the logs are held for 90 days.

 

Adam

Highlighted

@Adam Ochs Thanks for that advice bud.

 

#appreciate

Highlighted

Happy to help, us Exchange guys have to stick together ;)